@fenwave/agent 1.1.0

package/docker-actions/images.js

@@ -0,0 +1,1128 @@
+import { docker } from "./containers.js";
+import { formatSize, formatCreatedTime } from "../helper-functions.js";
+import registryStore from "../store/registryStore.js";
+import axios from "axios";
+import chalk from "chalk";
+import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
+
+// Function to verify Docker Hub push success
+async function verifyDockerHubPush(
+  username,
+  repoName,
+  tag,
+  authUsername,
+  authPassword
+) {
+  try {
+    // Docker Hub API endpoint to check if repository/tag exists
+    const apiUrl = `https://hub.docker.com/v2/repositories/${username}/${repoName}/tags/${tag}/`;
+
+    const response = await axios.get(apiUrl, {
+      auth: {
+        username: authUsername,
+        password: authPassword,
+      },
+      timeout: 10000,
+    });
+
+    return response.status === 200;
+  } catch (error) {
+    // If 404, the tag doesn't exist (push failed)
+    // If 401/403, authentication issue
+    // If other error, network/API issue
+    console.log(
+      chalk.red(
+        `❌ Docker Hub verification failed: ${
+          error.response?.status || error.message
+        }`
+      )
+    );
+    return false;
+  }
+}
+
+// Function to get ECR authentication token
+async function getEcrAuth(registryUrl, credentials) {
+  try {
+    // Validate that we have the required credentials
+    if (!credentials) {
+      throw new Error("ECR credentials not provided");
+    }
+
+    if (!credentials.accessKeyId || !credentials.secretAccessKey) {
+      throw new Error(
+        "ECR credentials are missing accessKeyId or secretAccessKey"
+      );
+    }
+
+    // Extract region from ECR URL
+    const urlParts = registryUrl.replace(/^https?:\/\//, "").split(".");
+    const region = urlParts[3]; // Extract region from ECR URL format
+
+    if (!region) {
+      throw new Error("Unable to extract region from ECR URL");
+    }
+
+    // Use the provided credentials or fall back to the region from URL if available
+    const ecrCredentials = {
+      accessKeyId: credentials?.accessKeyId,
+      secretAccessKey: credentials?.secretAccessKey,
+      sessionToken: credentials?.sessionToken,
+    };
+
+    // Remove undefined values
+    Object.keys(ecrCredentials).forEach((key) => {
+      if (ecrCredentials[key] === undefined) {
+        delete ecrCredentials[key];
+      }
+    });
+
+    const client = new ECRClient({
+      region: credentials?.region || region,
+      credentials: ecrCredentials,
+    });
+    const command = new GetAuthorizationTokenCommand({});
+    const response = await client.send(command);
+
+    const authData = response.authorizationData?.[0];
+    if (!authData) {
+      throw new Error("No authorization data received from ECR");
+    }
+
+    // Decode base64 token
+    const token = Buffer.from(authData.authorizationToken, "base64").toString();
+    const [username, password] = token.split(":");
+
+    return {
+      username,
+      password,
+      serveraddress: authData.proxyEndpoint, // e.g., https://123456789012.dkr.ecr.us-east-1.amazonaws.com
+    };
+  } catch (error) {
+    throw error;
+  }
+}
+
+// Helper function to generate meaningful error messages based on registry type and error
+function getRegistrySpecificErrorMessage(error, registry, imageName) {
+  const errorMessage = error.message || error.toString();
+
+  // Check for common error patterns
+  const isNotFound =
+    errorMessage.includes("404") ||
+    errorMessage.includes("not found") ||
+    errorMessage.includes("manifest unknown") ||
+    // Unauthorized can also mean "not found" when pulling from wrong registry
+    (errorMessage.includes("unauthorized") &&
+      errorMessage.includes("Not Authorized"));
+
+  const isAuthError =
+    errorMessage.includes("no basic auth credentials") ||
+    (errorMessage.includes("authentication") &&
+      !errorMessage.includes("Not Authorized")) ||
+    errorMessage.includes("access denied");
+
+  if (isAuthError) {
+    switch (registry?.type) {
+      case "ecr":
+        return `ECR authentication failed. Please check your AWS credentials and permissions: ${errorMessage}`;
+      case "docker-hub":
+        return `Docker Hub authentication failed. Please check your username and password: ${errorMessage}`;
+      case "gcr":
+        return `GCR authentication failed. Please check your service account credentials: ${errorMessage}`;
+      case "acr":
+        return `ACR authentication failed. Please check your credentials: ${errorMessage}`;
+      default:
+        return `Registry authentication failed. Please check your credentials: ${errorMessage}`;
+    }
+  }
+
+  if (isNotFound) {
+    switch (registry?.type) {
+      case "ecr":
+        return `Image "${imageName}" not found in "${registry.name}" registry. Please verify the image name and tag exist.`;
+      case "docker-hub":
+        return `Image "${imageName}" not found in "${registry.name}" registry. Please verify the repository name and tag exist.`;
+      case "gcr":
+        return `Image "${imageName}" not found in "${registry.name}" registry. Please verify the image path and tag exist.`;
+      case "acr":
+        return `Image "${imageName}" not found in "${registry.name}" registry. Please verify the repository and tag exist.`;
+      case "custom":
+        return `Image "${imageName}" not found in "${registry.name}" registry. Please verify the image exists.`;
+      default:
+        return `Image "${imageName}" not found in registry "${
+          registry?.name || "selected registry"
+        }". Please verify the image name and tag exist.`;
+    }
+  }
+
+  // For other errors, return a generic message with the original error
+  return `Failed to pull image "${imageName}" from ${
+    registry?.name || "registry"
+  }: ${errorMessage}`;
+}
+
+async function handleImageAction(ws, action, payload) {
+  switch (action) {
+    case "fetchImages":
+      return await handleFetchImages(ws, payload);
+    case "pullImage":
+      return await handlePullImage(ws, payload);
+    case "deleteImage":
+      return await handleDeleteImage(ws, payload);
+    case "pushImage":
+      return await handlePushImage(ws, payload);
+    case "tagImage":
+      return await handleTagImage(ws, payload);
+    case "inspectImage":
+      return await handleInspectImage(ws, payload);
+    default:
+      throw new Error(`Unknown image action: ${action}`);
+  }
+}
+
+async function handleFetchImages(ws, payload = {}) {
+  try {
+    const images = await docker.listImages();
+    const formattedImages = [];
+
+    images.forEach((image) => {
+      if (image.RepoTags && image.RepoTags.length > 0) {
+        // Create a separate entry for each tag
+        image.RepoTags.forEach((repoTag) => {
+          if (repoTag !== "<none>:<none>") {
+            const parts = repoTag.split(":");
+            const name = parts[0];
+            const tag = parts.length > 1 ? parts[1] : "latest";
+
+            formattedImages.push({
+              id: `${image.Id}-${name}:${tag}`, // Create unique ID for each tag
+              dockerId: image.Id, // Keep original Docker image ID
+              name,
+              tag,
+              size: formatSize(image.Size),
+              created: formatCreatedTime(image.Created),
+            });
+          }
+        });
+      } else {
+        // Handle images without tags
+        formattedImages.push({
+          id: `${image.Id}-<none>:<none>`, // Create unique ID
+          dockerId: image.Id, // Keep original Docker image ID
+          name: "<none>",
+          tag: "<none>",
+          size: formatSize(image.Size),
+          created: formatCreatedTime(image.Created),
+        });
+      }
+    });
+
+    ws.send(
+      JSON.stringify({
+        type: "images",
+        images: formattedImages,
+        requestId: payload.requestId,
+      })
+    );
+  } catch (error) {
+    console.error("Error fetching images:", error);
+    ws.send(
+      JSON.stringify({
+        type: "error",
+        error: "Failed to fetch images: " + error.message,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+async function handlePullImage(ws, payload) {
+  try {
+    const { imageTag, registryId, requestId } = payload;
+
+    // Get the registry details if registryId is provided
+    let registry = null;
+    if (registryId && registryId.trim() !== "") {
+      registry = await registryStore.getRegistryWithCredentials(registryId);
+    }
+
+    // Split image tag into name and tag
+    const [name, tag = "latest"] = imageTag.split(":");
+
+    // Check if the image already exists locally
+    const existingImages = await docker.listImages();
+    const existingImage = existingImages.find(
+      (image) => image.RepoTags && image.RepoTags.includes(`${name}:${tag}`)
+    );
+
+    if (existingImage) {
+      console.log(`⚠️ Image ${name}:${tag} already exists locally`);
+      ws.send(
+        JSON.stringify({
+          type: "pullWarning",
+          imageTag: `${name}:${tag}`,
+          requestId,
+        })
+      );
+      ws.send(
+        JSON.stringify({
+          type: "imagePulled",
+          image: {
+            id: `${existingImage.Id}-${name}:${tag}`,
+            dockerId: existingImage.Id,
+            name,
+            tag,
+            size: formatSize(existingImage.Size),
+            created: formatCreatedTime(existingImage.Created),
+          },
+          requestId,
+        })
+      );
+      return;
+    }
+
+    let pullCommand = `${name}:${tag}`;
+
+    // Handle different registry types
+    if (registry) {
+      console.log(
+        `🔍 Pulling image: ${pullCommand} from registry: ${registry.name} (${registry.type})`
+      );
+
+      // Send initial pulling started notification
+      ws.send(
+        JSON.stringify({
+          type: "pullStarted",
+          imageTag: pullCommand,
+          registry: registry.name,
+          requestId,
+        })
+      );
+
+      switch (registry.type) {
+        case "docker-hub":
+          pullCommand = `${name}:${tag}`;
+          // Docker Hub authentication will be handled in the pull options
+          break;
+
+        case "ecr": {
+          // Extract only the registry host (strip protocol and any path/tag)
+          const registryHost = (registry.url || "")
+            .replace(/^https?:\/\//, "")
+            .split("/")[0];
+          // If the provided image name already includes the registry host, don't prefix it again
+          if (name === registryHost || name.startsWith(`${registryHost}/`)) {
+            pullCommand = `${name}:${tag}`;
+          } else {
+            pullCommand = `${registryHost}/${name}:${tag}`;
+          }
+          break;
+        }
+
+        case "gcr": {
+          const registryHost = (registry.url || "")
+            .replace(/^https?:\/\//, "")
+            .split("/")[0];
+          if (name === registryHost || name.startsWith(`${registryHost}/`)) {
+            pullCommand = `${name}:${tag}`;
+          } else {
+            pullCommand = `${registryHost}/${name}:${tag}`;
+          }
+          break;
+        }
+
+        case "acr": {
+          const registryHost = (registry.url || "")
+            .replace(/^https?:\/\//, "")
+            .split("/")[0];
+          if (name === registryHost || name.startsWith(`${registryHost}/`)) {
+            pullCommand = `${name}:${tag}`;
+          } else {
+            pullCommand = `${registryHost}/${name}:${tag}`;
+          }
+          break;
+        }
+
+        case "custom": {
+          const registryHost = (registry.url || "")
+            .replace(/^https?:\/\//, "")
+            .split("/")[0];
+          if (name === registryHost || name.startsWith(`${registryHost}/`)) {
+            pullCommand = `${name}:${tag}`;
+          } else {
+            pullCommand = `${registryHost}/${name}:${tag}`;
+          }
+          // Custom registry authentication will be handled in the pull options
+          break;
+        }
+      }
+    } else {
+      console.log(`🔍 Pulling image: ${pullCommand} from Docker Hub (public)`);
+
+      ws.send(
+        JSON.stringify({
+          type: "pullStarted",
+          imageTag: pullCommand,
+          registry: "Docker Hub",
+          requestId,
+        })
+      );
+    }
+
+    // Attempt to pull the image
+    try {
+      // Prepare authentication options if needed
+      let pullOptions = {};
+
+      if (registry) {
+        let authconfig = {};
+
+        switch (registry.type) {
+          case "docker-hub":
+            if (
+              registry.credentials?.username &&
+              registry.credentials?.password
+            ) {
+              authconfig = {
+                username: registry.credentials.username,
+                password: registry.credentials.password,
+                serveraddress: "https://index.docker.io/v1/",
+              };
+            }
+            break;
+          case "ecr":
+            try {
+              // Get ECR authentication token dynamically
+              authconfig = await getEcrAuth(registry.url, registry.credentials);
+            } catch (ecrAuthError) {
+              console.error(
+                chalk.red("❌ ECR authentication failed:", ecrAuthError.message)
+              );
+            }
+            break;
+          case "custom":
+            if (
+              registry.credentials?.username &&
+              registry.credentials?.password
+            ) {
+              authconfig = {
+                username: registry.credentials.username,
+                password: registry.credentials.password,
+                serveraddress: registry.url,
+              };
+            }
+            break;
+          // GCR and ACR typically use token-based auth which is handled differently
+          default:
+            break;
+        }
+
+        if (Object.keys(authconfig).length > 0) {
+          pullOptions.authconfig = authconfig;
+        }
+      }
+
+      const stream = await docker.pull(pullCommand, pullOptions);
+
+      // Send progress updates
+      docker.modem.followProgress(
+        stream,
+        async (err, _) => {
+          if (err) {
+            console.error(
+              chalk.red(`❌ Failed to pull ${pullCommand}:`, err.message)
+            );
+
+            // Generate registry-specific error message
+            const errorMessage = getRegistrySpecificErrorMessage(
+              err,
+              registry,
+              pullCommand
+            );
+
+            ws.send(
+              JSON.stringify({
+                type: "pullError",
+                error: errorMessage,
+                requestId,
+              })
+            );
+            return;
+          }
+
+          // Successfully pulled from the original registry
+          await handleSuccessfulPull(
+            ws,
+            pullCommand,
+            registry ? registry.name : "Docker Hub",
+            name,
+            tag,
+            requestId
+          );
+        },
+        (event) => {
+          if (event.progress || event.status) {
+            ws.send(
+              JSON.stringify({
+                type: "pullProgress",
+                imageTag: pullCommand,
+                progress: event,
+                requestId,
+              })
+            );
+          }
+        }
+      );
+    } catch (pullError) {
+      console.error(
+        chalk.red(`❌ Failed to initiate pull for ${pullCommand}:`),
+        pullError.message
+      );
+
+      // Generate registry-specific error message
+      const errorMessage = getRegistrySpecificErrorMessage(
+        pullError,
+        registry,
+        pullCommand
+      );
+
+      ws.send(
+        JSON.stringify({
+          type: "pullError",
+          error: errorMessage,
+          requestId,
+        })
+      );
+    }
+  } catch (error) {
+    console.error("Error pulling image:", error);
+    ws.send(
+      JSON.stringify({
+        type: "pullError",
+        error: "Failed to pull image: " + error.message,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+// Helper function to handle successful pull completion
+async function handleSuccessfulPull(
+  ws,
+  pullCommand,
+  registryName,
+  name,
+  tag,
+  requestId
+) {
+  try {
+    // Get the pulled image
+    const images = await docker.listImages({
+      filters: { reference: [pullCommand] },
+    });
+
+    if (images.length === 0) {
+      // Try to find image with just name:tag if full path didn't work
+      const alternativeImages = await docker.listImages({
+        filters: { reference: [`${name}:${tag}`] },
+      });
+
+      if (alternativeImages.length === 0) {
+        ws.send(
+          JSON.stringify({
+            type: "pullError",
+            error: "Image not found after pull",
+            requestId,
+          })
+        );
+        return;
+      }
+
+      const image = alternativeImages[0];
+      console.log(
+        `✅ Successfully pulled: ${name}:${tag} from ${registryName} registry`
+      );
+
+      ws.send(
+        JSON.stringify({
+          type: "pullCompleted",
+          imageTag: `${name}:${tag}`,
+          registry: registryName,
+          requestId,
+        })
+      );
+
+      ws.send(
+        JSON.stringify({
+          type: "imagePulled",
+          image: {
+            id: `${image.Id}-${name}:${tag}`,
+            dockerId: image.Id,
+            name,
+            tag,
+            size: formatSize(image.Size),
+            created: formatCreatedTime(image.Created),
+          },
+          requestId,
+        })
+      );
+      return;
+    }
+
+    const image = images[0];
+    console.log(
+      `✅ Successfully pulled: ${pullCommand} from ${registryName} registry`
+    );
+
+    ws.send(
+      JSON.stringify({
+        type: "pullCompleted",
+        imageTag: pullCommand,
+        registry: registryName,
+        requestId,
+      })
+    );
+
+    ws.send(
+      JSON.stringify({
+        type: "imagePulled",
+        image: {
+          id: `${image.Id}-${name}:${tag}`,
+          dockerId: image.Id,
+          name,
+          tag,
+          size: formatSize(image.Size),
+          created: formatCreatedTime(image.Created),
+        },
+        requestId,
+      })
+    );
+  } catch (error) {
+    console.error("Error in handleSuccessfulPull:", error);
+    ws.send(
+      JSON.stringify({
+        type: "pullError",
+        error: "Failed to process pulled image: " + error.message,
+        requestId,
+      })
+    );
+  }
+}
+
+async function handleDeleteImage(ws, payload) {
+  try {
+    // Check if this is a specific tag deletion (format: imageId-name:tag)
+    const isTagSpecific = payload.id.includes("-") && payload.id.includes(":");
+
+    if (isTagSpecific) {
+      // Extract the tag name from the composite ID
+      const parts = payload.id.split("-");
+      if (parts.length >= 2) {
+        const tagName = parts.slice(1).join("-"); // Rejoin in case image name contains dashes
+        console.log(`🗑️  Deleting image: ${tagName}`);
+
+        // Use the tag name to remove just this tag
+        const image = docker.getImage(tagName);
+        await image.remove({ force: false, noprune: true });
+      } else {
+        throw new Error("Invalid tag format in image ID");
+      }
+    } else {
+      // This is a direct image ID deletion (fallback for old format)
+      const image = docker.getImage(payload.id);
+
+      // Check if force delete is requested
+      const options = {};
+      if (payload.force) {
+        options.force = true;
+        console.log(`⚠️ Force deleting image: ${payload.id}`);
+      }
+
+      await image.remove(options);
+      console.log(`✅ Successfully deleted image: ${payload.id}`);
+    }
+
+    ws.send(
+      JSON.stringify({
+        type: "imageDeleted",
+        id: payload.id,
+        success: true,
+        requestId: payload.requestId,
+      })
+    );
+  } catch (error) {
+    console.error("Error deleting image:", error);
+
+    let errorMessage = "Failed to delete image: " + error.message;
+    let errorCode = null;
+
+    // Handle specific Docker error cases
+    if (error.statusCode === 409) {
+      errorCode = "CONFLICT";
+      if (error.message.includes("image is being used by running container")) {
+        const containerMatch = error.message.match(/container ([a-f0-9]+)/);
+        const containerId = containerMatch ? containerMatch[1] : "unknown";
+        errorMessage = `Cannot delete image: it's being used by running container ${containerId}. Stop the container first or use force delete.`;
+      } else if (error.message.includes("image has dependent child images")) {
+        errorMessage =
+          "Cannot delete image: it has dependent child images. Delete child images first or use force delete.";
+      }
+    } else if (error.statusCode === 404) {
+      errorCode = "NOT_FOUND";
+      errorMessage = "Image not found. It may have already been deleted.";
+    }
+
+    ws.send(
+      JSON.stringify({
+        type: "error",
+        error: errorMessage,
+        errorCode,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+async function handlePushImage(ws, payload) {
+  try {
+    const { imageTag, registryId, requestId } = payload;
+
+    // Get the registry details
+    const registry = await registryStore.getRegistryWithCredentials(registryId);
+    if (!registry) {
+      throw new Error("Registry not found");
+    }
+
+    console.log(
+      `🚀 Pushing image: ${imageTag} to registry: ${registry.name} (${registry.type})`
+    );
+
+    // Validate registry has required credentials
+    if (registry.type === "docker-hub") {
+      if (!registry.credentials?.username && !registry.username) {
+        throw new Error(
+          "Docker Hub username not found in registry credentials"
+        );
+      }
+      if (!registry.credentials?.password) {
+        throw new Error(
+          "Docker Hub password not found in registry credentials"
+        );
+      }
+    }
+
+    ws.send(
+      JSON.stringify({
+        type: "pushStarted",
+        imageTag: imageTag,
+        registry: registry.name,
+        requestId,
+      })
+    );
+
+    const [imageName, imageTagPart = "latest"] = imageTag.split(":");
+
+    // Find the local image first
+    const images = await docker.listImages();
+    const localImage = images.find(
+      (img) => img.RepoTags && img.RepoTags.some((tag) => tag === imageTag)
+    );
+
+    if (!localImage) {
+      throw new Error(`Local image ${imageTag} not found`);
+    }
+
+    // Format the image name for the target registry
+    let targetImageName;
+    let authConfig = {};
+
+    switch (registry.type) {
+      case "docker-hub":
+        // For Docker Hub, extract the actual image name without any existing namespace
+        const baseImageName = imageName.includes("/")
+          ? imageName.split("/").pop()
+          : imageName;
+        const dockerHubUsername =
+          registry.credentials?.username || registry.username;
+        targetImageName = `${dockerHubUsername}/${baseImageName}:${imageTagPart}`;
+
+        if (!dockerHubUsername) {
+          throw new Error(
+            "Docker Hub username not found in registry credentials"
+          );
+        }
+        if (!registry.credentials?.password) {
+          throw new Error(
+            "Docker Hub password not found in registry credentials"
+          );
+        }
+
+        authConfig = {
+          username: dockerHubUsername,
+          password: registry.credentials?.password,
+          serveraddress: "https://index.docker.io/v1/",
+        };
+        break;
+
+      case "ecr":
+        const ecrUrl = registry.url.replace("https://", "");
+        targetImageName = `${ecrUrl}/${imageName}:${imageTagPart}`;
+        try {
+          // Get ECR authentication token dynamically for push
+          authConfig = await getEcrAuth(registry.url, registry.credentials);
+        } catch (ecrAuthError) {
+          console.error(
+            chalk.red(
+              `❌ ECR authentication failed for push:`,
+              ecrAuthError.message
+            )
+          );
+          throw new Error(`ECR authentication failed: ${ecrAuthError.message}`);
+        }
+        break;
+
+      case "gcr":
+        const gcrUrl = registry.url.replace("https://", "");
+        targetImageName = `${gcrUrl}/${imageName}:${imageTagPart}`;
+        break;
+
+      case "acr":
+        const acrUrl = registry.url.replace("https://", "");
+        targetImageName = `${acrUrl}/${imageName}:${imageTagPart}`;
+        authConfig = {
+          username: registry.credentials?.username || registry.username,
+          password: registry.credentials?.password,
+          serveraddress: registry.url,
+        };
+        break;
+
+      case "custom":
+        const customUrl = registry.url.replace("https://", "");
+        targetImageName = `${customUrl}/${imageName}:${imageTagPart}`;
+        authConfig = {
+          username: registry.credentials?.username || registry.username,
+          password: registry.credentials?.password,
+          serveraddress: registry.url,
+        };
+        break;
+
+      default:
+        throw new Error(`Unsupported registry type: ${registry.type}`);
+    }
+
+    // Tag the image for the target registry
+    const dockerImage = docker.getImage(imageTag);
+    const [targetRepo, targetTag] = targetImageName.split(":");
+
+    await dockerImage.tag({ repo: targetRepo, tag: targetTag });
+
+    // Push the tagged image with authentication
+    const taggedImage = docker.getImage(targetImageName);
+    const pushOptions = {
+      tag: targetTag,
+    };
+
+    if (Object.keys(authConfig).length > 0) {
+      pushOptions.authconfig = authConfig;
+    }
+
+    const stream = await taggedImage.push(pushOptions);
+
+    // Send progress updates
+    docker.modem.followProgress(
+      stream,
+      async (err, output) => {
+        if (err) {
+          console.error(
+            chalk.red(`❌ Failed to push ${targetImageName}:`, err.message)
+          );
+
+          let errorMessage = `Failed to push image: ${err.message}`;
+          if (
+            registry.type === "docker-hub" &&
+            (err.message.includes("denied") ||
+              err.message.includes("unauthorized"))
+          ) {
+            errorMessage = `Push denied to Docker Hub. Please check: 1) Repository name is correct, 2) You have push access to '${targetImageName}', 3) Your credentials are valid.`;
+          }
+
+          // Clean up the temporary tag on error
+          try {
+            const tempTaggedImage = docker.getImage(targetImageName);
+            await tempTaggedImage.remove({ force: false, noprune: false });
+            console.log(
+              `🧹 Cleaned up temporary tag after error: ${targetImageName}`
+            );
+          } catch (cleanupError) {
+            console.warn(
+              `⚠️ Could not clean up temporary tag after error: ${cleanupError.message}`
+            );
+          }
+
+          ws.send(
+            JSON.stringify({
+              type: "pushError",
+              error: errorMessage,
+              imageTag: imageTag,
+              requestId,
+            })
+          );
+          return;
+        }
+
+        // Check if push actually completed successfully by examining the output
+        let pushSuccess = false;
+        if (output && Array.isArray(output)) {
+          // Look for successful push indicators in the output
+          pushSuccess = output.some(
+            (item) =>
+              item.status &&
+              (item.status.includes("Pushed") ||
+                item.status.includes("Layer already exists") ||
+                item.status.includes(`${targetTag}: digest:`))
+          );
+        }
+
+        if (!pushSuccess) {
+          console.error(
+            chalk.red(
+              `❌ Push may have failed - no success indicators found in output`
+            )
+          );
+          ws.send(
+            JSON.stringify({
+              type: "pushError",
+              error: `Push to ${registry.name} may have failed - please check your registry access and credentials`,
+              imageTag: imageTag,
+              requestId,
+            })
+          );
+          return;
+        }
+
+        console.log(
+          `✅ Successfully pushed: ${targetImageName} to ${registry.name} registry`
+        );
+
+        // For Docker Hub, verify the push actually succeeded
+        let pushVerified = true;
+        if (registry.type === "docker-hub") {
+          const [dockerHubUsername, repoName] = targetRepo.split("/");
+          try {
+            pushVerified = await verifyDockerHubPush(
+              dockerHubUsername,
+              repoName,
+              targetTag,
+              authConfig.username,
+              authConfig.password
+            );
+
+            if (!pushVerified) {
+              console.error(
+                chalk.red(
+                  `❌ Docker Hub verification failed - image not found in registry`
+                )
+              );
+              ws.send(
+                JSON.stringify({
+                  type: "pushError",
+                  error: `Push to Docker Hub failed - image ${targetImageName} was not found in the registry. Please check your repository name and permissions.`,
+                  imageTag: imageTag,
+                  requestId,
+                })
+              );
+              return;
+            }
+          } catch (verifyError) {
+            console.warn(
+              `⚠️ Could not verify Docker Hub push: ${verifyError.message}`
+            );
+            // Continue without verification if API check fails
+          }
+        }
+
+        // Clean up the temporary tag
+        try {
+          const tempTaggedImage = docker.getImage(targetImageName);
+          await tempTaggedImage.remove({ force: false, noprune: false });
+        } catch (cleanupError) {
+          console.warn(
+            `⚠️ Could not clean up temporary tag: ${cleanupError.message}`
+          );
+        }
+
+        ws.send(
+          JSON.stringify({
+            type: "pushCompleted",
+            imageTag: imageTag,
+            registry: registry.name,
+            requestId,
+          })
+        );
+
+        ws.send(
+          JSON.stringify({
+            type: "imagePushed",
+            image: {
+              id: localImage.Id,
+              name: targetRepo,
+              tag: targetTag,
+              pushed: true,
+              registry: registry.name,
+              targetImageName: targetImageName,
+            },
+            requestId,
+          })
+        );
+      },
+      (event) => {
+        if (event.progress || event.status) {
+          ws.send(
+            JSON.stringify({
+              type: "pushProgress",
+              imageTag: targetImageName,
+              progress: event,
+              requestId,
+            })
+          );
+        }
+      }
+    );
+  } catch (error) {
+    console.error("Error pushing image:", error);
+    ws.send(
+      JSON.stringify({
+        type: "pushError",
+        error: "Failed to push image: " + error.message,
+        imageTag: payload.imageTag,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+async function handleTagImage(ws, payload) {
+  try {
+    const { id, newTag, requestId } = payload;
+
+    const [repo, tag = "latest"] = newTag.split(":");
+
+    // Validate the repo and tag format
+    if (!repo || repo.trim() === "") {
+      throw new Error("Repository name cannot be empty");
+    }
+
+    // Check if the tag already exists
+    const existingImages = await docker.listImages();
+    const tagExists = existingImages.some(
+      (img) =>
+        img.RepoTags && img.RepoTags.includes(`${repo.trim()}:${tag.trim()}`)
+    );
+
+    if (tagExists) {
+      throw new Error(
+        `Tag '${repo.trim()}:${tag.trim()}' already exists. Please choose a different tag name.`
+      );
+    }
+
+    const image = docker.getImage(id);
+    await image.tag({ repo: repo.trim(), tag: tag.trim() });
+
+    console.log(`✅ Successfully tagged image ${id} as ${repo}:${tag}`);
+
+    // Get the tagged image
+    const images = await docker.listImages();
+    const taggedImage = images.find(
+      (img) => img.RepoTags && img.RepoTags.includes(`${repo}:${tag}`)
+    );
+
+    if (!taggedImage) {
+      console.error(
+        chalk.red(`❌ Tagged image ${repo}:${tag} not found in list`)
+      );
+      ws.send(
+        JSON.stringify({
+          type: "error",
+          error: "Tagged image not found after tagging operation",
+          requestId,
+        })
+      );
+      return;
+    }
+
+    const responseImage = {
+      id: `${taggedImage.Id}-${repo}:${tag}`, // Create unique ID for the table
+      dockerId: taggedImage.Id, // Original Docker image ID
+      name: repo,
+      tag,
+      size: formatSize(taggedImage.Size),
+      created: formatCreatedTime(taggedImage.Created),
+    };
+
+    ws.send(
+      JSON.stringify({
+        type: "imageTagged",
+        image: responseImage,
+        requestId,
+      })
+    );
+  } catch (error) {
+    let errorMessage = "Failed to tag image: " + error.message;
+
+    // Handle specific Docker error cases
+    if (
+      error.message.includes("already exists") ||
+      error.message.includes("Tag")
+    ) {
+      // This is our custom duplicate tag error
+      errorMessage = error.message;
+    } else if (error.statusCode === 409) {
+      errorMessage = "Tag already exists. Please choose a different tag name.";
+    } else if (error.statusCode === 404) {
+      errorMessage = "Image not found. It may have been deleted.";
+    } else if (
+      error.message.includes("invalid") ||
+      error.message.includes("Invalid")
+    ) {
+      errorMessage = error.message;
+    }
+
+    ws.send(
+      JSON.stringify({
+        type: "error",
+        error: errorMessage,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+async function handleInspectImage(ws, payload) {
+  try {
+    const { id, requestId } = payload;
+    const image = docker.getImage(id);
+    const inspectionData = await image.inspect();
+
+    ws.send(
+      JSON.stringify({
+        type: "imageInspected",
+        data: inspectionData,
+        requestId,
+      })
+    );
+  } catch (error) {
+    console.error("Error inspecting image:", error);
+    ws.send(
+      JSON.stringify({
+        type: "error",
+        error: "Failed to inspect image: " + error.message,
+        requestId: payload.requestId,
+      })
+    );
+  }
+}
+
+export default { handleImageAction };
+
+export { handleImageAction };